gns.tex (11934B)
1 \documentclass[aspectratio=169]{beamer} 2 \usepackage{appendixnumberbeamer} 3 \usepackage{mathtools} 4 \usetheme{metropolis} % Use metropolis theme 5 \definecolor{fhggreen}{RGB}{23,156,125} 6 \let\oldemph\textbf 7 \renewcommand{\textbf}[1]{{\color{mLightBrown}\oldemph{#1}}} 8 9 \usepackage{blkarray} 10 \usepackage{amsmath} 11 \usepackage{multirow} 12 \title{\includegraphics[width=0.2\textwidth]{gns-logo.png}\\\small{The GNU Name System | RFC 9498}} 13 \date{2024-02-22} 14 \author{Bernd Fix, Christian Grothoff, \textbf{Martin Schanzenbach}} 15 %\institute{\includegraphics[width=.25\textwidth]{aisec_logo.pdf}} 16 17 \graphicspath{{figures/}} 18 19 \begin{document} 20 \metroset{block=fill,sectionpage=progressbar,numbering=counter} 21 \maketitle 22 23 \begin{frame}{Directories / DNS} 24 $$ 25 \mathrlap{\overbrace{\phantom{\text{www}}}^{\text{Label}}} 26 \text{www.} 27 \mathrlap{\underbrace{{\color{fhggreen}\phantom{\text{.example.com}}}}_{\text{Zone}}} 28 {\color{fhggreen}\text{example.com}} 29 $$ 30 \end{frame} 31 32 \begin{frame}{The Domain Name System} 33 Whats wrong with DNS? See RFC 8324\footnote{DNS Privacy, Authorization, Special Uses, Encoding, Characters, 34 Matching, and Root Structure: Time for Another Look?}: 35 \begin{itemize} 36 \item No \textbf{query privacy}. 37 \item A \textbf{single hierarchy with a centrally controlled root}. 38 \item Requires management/maintenance of \textbf{root servers}. 39 \item etc\ldots 40 \end{itemize} 41 DNSSEC and other ``patches'' do not or in adequately address the issues: ``[the existing solutions for DNS are] security patches rather than designed-in 42 security or privacy mechanisms''. 43 \end{frame} 44 45 \begin{frame}{Directories / GNS} 46 $$ 47 \mathrlap{\overbrace{\phantom{\text{www}}}^{\text{Label}}} 48 \text{www.} 49 \mathrlap{\underbrace{{\color{fhggreen}\phantom{\text{.myzone.gns.alt}}}}_{\text{Zone}}} 50 {\color{fhggreen}\text{myzone.gns.alt}} 51 $$ 52 \end{frame} 53 54 \begin{frame}{The .alt TLD} 55 Why ``.gns.alt''? 56 \begin{itemize} 57 \item RFC9476: ``The .alt Special-Use Top-Level Domain'' defines the TLD to be used for alternative (from the point of view of DNS) name systems. 58 \item RFC9476 does \textbf{not} define a registry for ``.alt''-subdomains. 59 \item We manage a ``.alt'' registry at \url{https://gana.gnunet.org}~\footnote{If you ever need a registry for your protocol feel free to approach us!} which already includes a code point for ``.gns.alt''. 60 \item To prevent shadowing of DNS names, it is recommended to use the ``.gns.alt'' suffix. 61 \item Sometimes (e.g. censorship-overrides) you may not want to do that. 62 \end{itemize} 63 \end{frame} 64 65 \begin{frame}{The GNU Name System} 66 \begin{itemize} 67 \item Zones are created and uniquely identified using \textbf{public zone keys}. 68 \item \textbf{Records} are grouped by \textbf{label}, encrypted, signed, and published in a key-value store (usually, a DHT\footnote{\url{https://datatracker.ietf.org/doc/draft-schanzen-r5n/}}). 69 \item Supported zone types and crypto (for now): 70 \begin{itemize} 71 \item PKEY: ECDSA+CTR-AES-256 72 \item EDKEY: EdDSA+XSalsa20-Poly1305 73 \end{itemize} 74 \end{itemize} 75 \centering 76 \includegraphics[width=1\textwidth]{GNS-BlockCreation-0} 77 \end{frame} 78 79 \begin{frame}{Zone key TLD} 80 $$ 81 \mathrlap{\overbrace{\phantom{\text{www}}}^{\text{Label}}} 82 \text{www.} 83 \mathrlap{\underbrace{{\color{fhggreen}\phantom{\text{000G005096M367VCT5D\ldots BXVBBBHX1GF0}}}}_{\text{Zone}}} 84 {\color{fhggreen}\text{000G005096M367VCT5D\ldots BXVBBBHX1GF0}} 85 $$ 86 \end{frame} 87 88 \begin{frame}{Zone management} 89 \includegraphics[height=0.9\textheight]{deleg0.pdf} 90 \end{frame} 91 92 93 \begin{frame}{Name resolution} 94 \includegraphics[height=0.9\textheight]{deleg1.pdf} 95 \end{frame} 96 97 98 \begin{frame}{Name resolution} 99 \includegraphics[height=0.9\textheight]{deleg2.pdf} 100 \end{frame} 101 102 103 \begin{frame}{How do we bootstrap the top-level zones?} 104 \includegraphics[height=0.9\textheight]{deleg3.pdf} 105 \end{frame} 106 107 108 \begin{frame}[fragile]{The Start Zone} 109 ``Hyper-hyper local root'' concept we call the \textbf{Start Zone}: 110 \begin{itemize} 111 \item Start Zone contains so-called \textbf{suffix-to-zone}-mappings. 112 \item Implementation ships with an \emph{initial} Start Zone configuration. 113 \item Start Zone is configurable \emph{locally} at \emph{each} endpoint. 114 \item User override/extension of mappings at top-level or subdomain-level to\ldots 115 \begin{itemize} 116 \item circumvent censorship if necessary, or 117 \item names in private networks. 118 \end{itemize} 119 \end{itemize} 120 \end{frame} 121 122 \begin{frame}[fragile]{The Start Zone} 123 Example suffix-to-zone mappings: 124 \begin{small} 125 \begin{verbatim} 126 # Some TLDs 127 .com = 000G001MF6DVMZZ4Y8XRZQDXM1PB3D3VGEK29ZHXBA57EPSNW1QBPKT8J0 128 .myzone.gns.alt = 000G007FKSA876G6SNDF8VA7YK1DJE96RPPBHRT2X55Q13M2T4YKNYT3DG 129 # Some subdomain overrides 130 .gnu.org = 000G001223Q8ZJZBSK6XT2DWV6PE5B1W436D2NB7ZBR9XSXT7TFJHCDB24 131 .gnunet.gns.alt = 000G0047M3HN599H57MPXZK4VB59SWK4M9NRD68E1JQFY3RWAHDMKAPN30 132 \end{verbatim} 133 \end{small} 134 \end{frame} 135 136 \begin{frame}[fragile]{GNS Registrars} 137 How do I get my zone published? 138 \begin{itemize} 139 \item Entities in Start Zones are prime candiates to offer registrar services. 140 \item But, \textbf{anyone} can become a registrar! 141 \item The GNUnet Project offers an experimental registrar service where you can pay with GNU Taler. 142 \end{itemize} 143 \end{frame} 144 145 % \begin{frame}{Default Start Zones --- Possible Governance Models} 146 % \begin{itemize} 147 % \item Non-profit organization. 148 % \item Multi-stakeholder model: Board, supporting organizations, \ldots 149 % \item Examples for possible stakeholders: 150 % \begin{itemize} 151 % \item Software and OS Distributors 152 % \item Browser vendors 153 % \item Governments 154 % \end{itemize} 155 % \item Funding options: 156 % \begin{itemize} 157 % \item Applications for new top-level domains. 158 % \item Registrations of new top-level domains. 159 % \item \ldots 160 % \end{itemize} 161 % \end{itemize} 162 % \end{frame} 163 164 \begin{frame}{Hiding information inside GNS} 165 \begin{itemize} 166 \item GNS's crypto allows you to hide resource records. 167 \item It requires either 168 \begin{itemize} 169 \item the use of a label with sufficient entropy (a shared secret) or 170 \item the use of a secret zone. 171 \end{itemize} 172 \end{itemize} 173 $$ 174 \mathrlap{\overbrace{\phantom{\text{ohcoxaiShaingahd}}}^{\text{Secret label}}} 175 \text{ohcoxaiehaingahd} 176 \mathrlap{\underbrace{{\color{fhggreen}\phantom{\text{.my.zone}}}}_{\text{Namespace}}} 177 {\color{fhggreen}\text{.my.zone}} 178 $$ 179 \end{frame} 180 181 182 \begin{frame}{Encrypt} 183 \centering 184 \includegraphics[width=1\textwidth]{GNS-BlockCreation-1} 185 \end{frame} 186 187 \begin{frame}{Sign} 188 \centering 189 \includegraphics[height=0.9\textheight]{GNS-BlockCreation-2} 190 \end{frame} 191 192 \begin{frame}{Derive} 193 \centering 194 \includegraphics[height=0.9\textheight]{GNS-BlockCreation-3} 195 \end{frame} 196 197 \begin{frame}{Combine and publish} 198 \centering 199 \includegraphics[width=1\textwidth]{GNS-BlockCreation-4} 200 \end{frame} 201 202 \begin{frame}{Query} 203 \centering 204 \includegraphics[height=0.9\textheight]{GNS-BlockValidation-0} 205 \end{frame} 206 207 \begin{frame}{Retrieve} 208 \centering 209 \includegraphics[height=0.9\textheight]{GNS-BlockValidation-1} 210 \end{frame} 211 212 \begin{frame}{Verify} 213 \centering 214 \includegraphics[height=0.9\textheight]{GNS-BlockValidation-2} 215 \end{frame} 216 217 \begin{frame}{Decrypt} 218 \centering 219 \includegraphics[height=0.9\textheight]{GNS-BlockValidation-3} 220 \end{frame} 221 222 \begin{frame}{Decrypt} 223 \centering 224 \includegraphics[height=0.9\textheight]{GNS-BlockValidation-4} 225 \end{frame} 226 227 \begin{frame}{The RFC journey} 228 \begin{itemize} 229 \item[2012:] ``GNU Alternative Domain System'', Master's Thesis, TUM. 230 \item[2013:] ``The GNU Name System'', 30c3, Hamburg. 231 \item[2015:] ``Special Use Domain Names of P2P Systems''@DNSOP, IETF 93, Prague. 232 \item[2019:] ``The GNU Name System: 2019 Edition''@DINRG, IETF 104, Prague 233 \item[2019:] ``The GNU Name System'', ICANN66, Montreal. 234 \end{itemize} 235 Around this time, NGI Search and discovery funding aquired to create the specification. 236 \end{frame} 237 238 \begin{frame}{Paths} 239 Potential paths to an RFC (incomplete): 240 \begin{itemize} 241 \item IETF 242 \begin{itemize} 243 \item Organized in working groups (WGs). E.g. DNSOP. 244 \item Work on ``Standards''. 245 \item \textbf{IF} your document is adopted, control over its contents are given to the WG. 246 \item Publication requires \textbf{consensus}. 247 \end{itemize} 248 \item IRTF 249 \begin{itemize} 250 \item Similar to IETF WGs but focussed on research topics. E.g. DINRG. 251 \item Technically don't work on ``Standards'' (RFCs never have status ``Proposed Standard''). 252 \end{itemize} 253 \item ISE 254 \begin{itemize} 255 \item Process outside of the IETF. 256 \item You retain most of the control over the document. 257 \item Requires ISE to accept it for publication and that it does not conflict with work in the IETF. 258 \end{itemize} 259 \end{itemize} 260 \end{frame} 261 262 \begin{frame}{The RFC journey} 263 \begin{itemize} 264 \item[2020/5:] First draft submission to IETF datatracker. IRTF and other research groups approached (through mailing list) asking for interest and adoption. 265 \item[2020/7:] ``The GNU Name System''@SECDISPATCH, IETF 108, Online. IRTF and other research groups approached (through mailing list) asking for interest and adoption. 266 \item[2021/5:] Asked Independent Stream Editor for adoption. 267 \item[2021/11:] Draft adopted by Independent Stream Editor. 268 \item[2023/11:] RFC 9498 published. 269 \end{itemize} 270 \textbf{Note:} Publication through the ISE is not technically related to standardization (RFC publication $\neq$ IETF standardization). But, it is a very enriching and helpful process in any case! 271 \end{frame} 272 273 \begin{frame}{The Independent Stream} 274 There will be questions, and feedback! 275 \begin{itemize} 276 \item ``Why should this document be published as RFC (as opposed to self-published)'' 277 \item You need to propose (at least) two expert reviewers that can (and will!) provide extensive expert reviews to the ISE. The ISE may be able to help you with that, but take this into account \textbf{early}. 278 \item There is going to be a lot of ping-pong with the ISE and all kinds of reviewers of the document from withing or outside of the IETF. 279 \end{itemize} 280 \end{frame} 281 282 \begin{frame}{The IESG review} 283 \begin{itemize} 284 \item The ``final hurdle''. 285 \item Includes the ``IETF conflict review''. 286 \item In our case, GNS potentially conflicts with other IETF work: DNS. 287 \item Again, extensive discussions with domain experts (DNSOP, IESG reviewer). 288 \item Close coordination with RFC 9476 (dot-alt) to argumentatively deconflict. 289 \end{itemize} 290 \end{frame} 291 292 \begin{frame}{The RFC editor} 293 \begin{itemize} 294 \item Very helpful editorial review and proofreading. 295 \item Can be a rather long process (2023/7 --- 2023/11). Note: RFC 9498 is 74 PDF pages. 296 \item Usually not a lot of actual work (for you). 297 \end{itemize} 298 \end{frame} 299 300 \begin{frame}{In retrospect} 301 \begin{itemize} 302 \item GNS was a politically loaded document with historical baggage (special-use domains etc.). 303 \item ISE process was very beneficial: 304 \begin{itemize} 305 \item Thinking again from an implementer's perspective (also: alternative implementations!). 306 \item Important details that destroy interoperability. Example: UTF-8 canoncalization for labels. 307 \item Design oversights. Example: Tombstone records for deleted record sets required to prevent accidental IV reuse. 308 \end{itemize} 309 \item Other specification efforts: \url{https://datatracker.ietf.org/doc/draft-schanzen-r5n/}. 310 \end{itemize} 311 \end{frame} 312 313 314 \begin{frame} 315 \begin{center} 316 Questions?\\ 317 \vspace{2cm} 318 \url{https://gnunet.org}\\ 319 \vspace{1em} 320 {\tiny 321 \texttt{schanzen@gnu.org}\\ 322 \texttt{3D11~063C~10F9~8D14~BD24~D147~0B09~98EF~86F5~9B6A}\\ 323 } 324 \end{center} 325 \end{frame} 326 327 \end{document}